CmdID

CmdID / Files

splwow64.exe

Print driver host for applications file version info

Program on Windows 10 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real splwow64.exe?

file version info and known copies
Installed inC:\Windows\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionPrint driver host for applications

10 known copies

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\splwow64.exe · signed by Microsoft Windows

4b4cf1daa89cc701a00cb3bc94db9433e01a37fc738318dcc76d2f62f34d0a15

10.0.19041.685 (WinBuild.160101.0800) · C:\Windows\splwow64.exe · signed by Microsoft Windows

f00450b2dcea43504642c00c4d5b725003e23ad00928be0a5ad381e920561ea7

10.0.19041.388 (WinBuild.160101.0800) · C:\Windows\splwow64.exe · signed by Microsoft Windows

edec0ed8fb5df666834d1c1d49c920ce23060a81b8121e4bc8e46369e026cf7e

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\splwow64.exe · signed by Microsoft Windows

fc6896ea784628446643dc1470d6c80c56cee888d7e170680792e4029372a6a3

10.0.19041.1288 (WinBuild.160101.0800) · C:\Windows\splwow64.exe · signed by Microsoft Windows

572954b4bd75be0fcafff46eac69b1dd9648d137b15c5d8b6dce8aaa0f7914d7

10.0.18362.476 (WinBuild.160101.0800) · C:\WINDOWS\splwow64.exe · signed by Microsoft Windows

70bf1c950110a5f30ccc8c8d85a6051b72d7e5a95d1cf8f347c86725b88f60c6

10.0.17763.1339 (WinBuild.160101.0800) · C:\Windows\splwow64.exe · signed by Microsoft Windows

70ad0fe5b39719c3d0a5edd2bea742bc7af35d6ef153d92fa1d011d34510e92c

10.0.17763.1282 (WinBuild.160101.0800) · C:\windows\splwow64.exe · signed by Microsoft Windows

a9ef565fa5c9882e28dd960e6507a97a727352c546c8d2f9229dcbd368952f32

10.0.14393.3630 (rs1_release.200407-1730) · C:\Windows\splwow64.exe · signed by Microsoft Windows

bcc166b2e9fa1483ca5fe851f0c5d7477ab1d029f20cf5ebbb1bcb01b9bfe506

6.3.9600.19727 (winblue_ltsb_escrow.200529-0549) · C:\windows\splwow64.exe · not signed

32f1211405b254d00f03cb7ced4570d898326b0099461e6896ce6ec8c2b517e2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name splwow64.exe
highSuspicious Splwow64 Without ParamsFlorian Roth (Nextron Systems)